Proactive Detection and Analysis GSOM Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A SOC manager is planning to integrate new data sources to improve proactive detection. The organization has a limited budget and can only integrate two new sources. The current sources are Windows event logs and firewall logs. The top detection priorities are early-stage reconnaissance and credential theft. Which two data sources should the manager prioritize?

   • AEndpoint process creation logs and web proxy logs.
   • BDNS query logs and authentication logs from domain controllers.
   • CNetFlow data and physical access logs.
   • DEmail gateway logs and vulnerability scanner logs.
   Reveal Solution Discussion Select an answer first
2. 52expert · medium

   A threat hunter is testing a hypothesis that a specific APT group is using 'living off the land' binaries to perform reconnaissance. The hunter has access to process creation logs and network connection logs, but the environment has a high volume of legitimate administrative activity. Which approach would most effectively validate the hypothesis without drowning in false positives?

   • AFocus the hunt on specific LOLBin executables and correlate their execution with network connections to internal IP ranges, then review the command-line arguments.
   • BSearch for any process that makes a network connection to an internal IP address.
   • CQuery the threat intelligence feed for the APT group's known IP addresses and alert on any connection to them.
   • DSearch for any execution of PowerShell, regardless of the command line.
   Reveal Solution Discussion Select an answer first